@atlasauth/chrome-extension 0.1.0

package/README.md

@@ -0,0 +1,90 @@
+# @atlasauth/chrome-extension
+
+The official Atlas SDK for Chrome / MV3 browser extensions — the extension peer
+of [`@atlasauth/react`](../react). It reuses the framework-agnostic
+[`@atlasauth/js`](../js) client for every API call and, through the `/react`
+entry point, the full React hook + component surface.
+
+The one architectural difference from the web SDK: **the web SDK carries the
+session in a cookie; a browser extension has no cookie jar to the Atlas FAPI
+origin.** So the session token is cached in `chrome.storage.local` and attached
+to every request by hand, as a bearer.
+
+## Entry points
+
+| Import from | Pulls in React? | Use in |
+| --- | --- | --- |
+| `@atlasauth/chrome-extension` | no | anywhere (core: store + client) |
+| `@atlasauth/chrome-extension/background` | no | the service worker |
+| `@atlasauth/chrome-extension/react` | yes (peer) | popup / options / side panel |
+
+## Background service worker
+
+```ts
+import { createAtlasClient } from '@atlasauth/chrome-extension/background';
+
+const atlas = createAtlasClient({
+  publishableKey: 'pk_...',
+  frontendApi: 'https://fapi.your-instance.atlasauth.net',
+  background: true,
+});
+
+// The service worker has no long-lived timer (MV3 evicts it), so refresh the
+// token whenever it wakes instead of on an in-page interval.
+chrome.alarms.create('atlas-refresh', { periodInMinutes: 1 });
+chrome.alarms.onAlarm.addListener((a) => {
+  if (a.name === 'atlas-refresh') void atlas.syncSessionToken();
+});
+```
+
+`syncSessionToken()` reads the stored token, and if it is inside its refresh lead
+window (or you pass `{ force: true }`) mints a fresh one via
+`POST /v1/client/sessions/:sid/tokens` and writes it back to `chrome.storage`.
+
+## Popup / options page (React)
+
+```tsx
+import { AtlasProvider, useAuth, useUser } from '@atlasauth/chrome-extension/react';
+
+export function App() {
+  return (
+    <AtlasProvider
+      publishableKey="pk_..."
+      frontendApi="https://fapi.your-instance.atlasauth.net"
+    >
+      <Profile />
+    </AtlasProvider>
+  );
+}
+```
+
+The provider wraps `@atlasauth/react`'s provider and injects a `fetch` that
+attaches the stored token as a bearer and captures any refreshed token back into
+`chrome.storage`. The token must already be in the store — seed it with
+`client.setToken(jwt)` after a hosted sign-in.
+
+## The store
+
+```ts
+import { StorageCache } from '@atlasauth/chrome-extension';
+
+const store = new StorageCache();       // chrome.storage.local, default key
+await store.setToken(jwt);
+await store.getToken();                  // string | null
+await store.removeToken();
+```
+
+`chrome` is typed structurally, so the package needs no `@types/chrome`. Pass a
+custom `area` (e.g. `chrome.storage.session`, or `createMemoryStorageArea()` in
+tests) to change where the token lives.
+
+## Manifest
+
+Add the `storage` permission and the Atlas FAPI origin as a host permission:
+
+```json
+{
+  "permissions": ["storage", "alarms"],
+  "host_permissions": ["https://fapi.your-instance.atlasauth.net/*"]
+}
+```

package/dist/background.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `@atlasauth/chrome-extension/background` — the service-worker surface.
+ *
+ * A convenience alias for the React-free core, named for where it is used. A
+ * background service worker creates the client once and refreshes the token on
+ * each wake:
+ *
+ *   import { createAtlasClient } from '@atlasauth/chrome-extension/background';
+ *
+ *   const atlas = createAtlasClient({
+ *     publishableKey: 'pk_...',
+ *     frontendApi: 'https://fapi.your-instance.atlasauth.net',
+ *     background: true,
+ *   });
+ *
+ *   chrome.alarms.create('atlas-refresh', { periodInMinutes: 1 });
+ *   chrome.alarms.onAlarm.addListener((a) => {
+ *     if (a.name === 'atlas-refresh') void atlas.syncSessionToken();
+ *   });
+ */
+export * from './storage';
+export * from './client';

package/dist/background.js

@@ -0,0 +1,39 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * `@atlasauth/chrome-extension/background` — the service-worker surface.
+ *
+ * A convenience alias for the React-free core, named for where it is used. A
+ * background service worker creates the client once and refreshes the token on
+ * each wake:
+ *
+ *   import { createAtlasClient } from '@atlasauth/chrome-extension/background';
+ *
+ *   const atlas = createAtlasClient({
+ *     publishableKey: 'pk_...',
+ *     frontendApi: 'https://fapi.your-instance.atlasauth.net',
+ *     background: true,
+ *   });
+ *
+ *   chrome.alarms.create('atlas-refresh', { periodInMinutes: 1 });
+ *   chrome.alarms.onAlarm.addListener((a) => {
+ *     if (a.name === 'atlas-refresh') void atlas.syncSessionToken();
+ *   });
+ */
+__exportStar(require("./storage"), exports);
+__exportStar(require("./client"), exports);
+//# sourceMappingURL=background.js.map

package/dist/background.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"background.js","sourceRoot":"","sources":["../src/background.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,4CAA0B;AAC1B,2CAAyB"}

package/dist/client.d.ts

@@ -0,0 +1,102 @@
+import { FapiClient, type ProviderToken } from '@atlasauth/js';
+import { type TokenStore } from './storage';
+/**
+ * The extension FAPI layer.
+ *
+ * Every network call goes through the framework-agnostic `@atlasauth/js`
+ * `FapiClient` — the same client the web and React Native SDKs use — so there is
+ * one implementation of "how an Atlas request is shaped". This module adds the
+ * one thing an extension needs that a first-party web page gets for free:
+ * **bearer auth**. The browser attaches the session via a cookie; an extension
+ * has none, so the token from the {@link TokenStore} rides in an
+ * `Authorization: Bearer` header instead.
+ */
+/** The session claims the SDK reads off the (unverified) JWT — a scheduling hint. */
+interface SessionTokenClaims {
+    sid?: string;
+    exp?: number;
+}
+/** Read the unverified claims out of a JWT. Never a security decision — the
+ *  server validates the signature; this only tells the client which session to
+ *  refresh and roughly when. Returns null for anything that is not a JWT. */
+export declare function decodeTokenClaims(jwt: string): SessionTokenClaims | null;
+/**
+ * Wrap a `fetch` so every request carries the current session token as a bearer.
+ * The token is read FRESH from the store on each call — never captured — so a
+ * refresh or a sign-out between requests is always reflected. A request made
+ * while signed out simply carries no `Authorization` header.
+ */
+export declare function bearerFetch(fetchImpl: typeof fetch, store: TokenStore): typeof fetch;
+/**
+ * A {@link bearerFetch} that ALSO captures a freshly-minted session token out of
+ * the response and persists it to the store.
+ *
+ * The web SDK's provider keeps its refreshed JWT in memory, which is exactly
+ * what an extension cannot do — the popup that received the token is closed
+ * moments later, and the service worker is torn down. So when a token-issuing
+ * endpoint (`/v1/client/...`) answers with a `jwt` in its JSON body, we write it
+ * back to `chrome.storage`, so the next request from ANY surface — and the next
+ * cold start of the service worker — picks up the current token. Scoped to
+ * `/v1/client` responses and guarded by JSON parsing, so a non-JSON or unrelated
+ * response is left untouched.
+ */
+export declare function persistingBearerFetch(fetchImpl: typeof fetch, store: TokenStore): typeof fetch;
+export interface CreateAtlasClientOptions {
+    publishableKey: string;
+    /** The instance's FAPI origin, e.g. `https://fapi.your-instance.atlasauth.net`. */
+    frontendApi: string;
+    /** Where the token lives. Defaults to `chrome.storage.local` via {@link StorageCache}. */
+    store?: TokenStore;
+    /** Injectable for tests; defaults to the platform `fetch`. */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * The extension client. A thin, React-free handle the background service worker
+ * and any extension page share: the `@atlasauth/js` FAPI client (bearer-wired),
+ * the token store, and the session-token lifecycle helpers.
+ */
+export interface AtlasClient {
+    /** The bearer-wired `@atlasauth/js` client for any raw FAPI call. */
+    readonly fapi: FapiClient;
+    /** The token store this client reads and writes. */
+    readonly store: TokenStore;
+    /** The current session token, or null when signed out. */
+    getToken(): Promise<string | null>;
+    /** Seed the token after an out-of-band sign-in (e.g. a hosted-page flow). */
+    setToken(token: string): Promise<void>;
+    /** The signed-in user's live token at a connected provider (Google, …). */
+    getProviderToken(provider: string): Promise<ProviderToken | null>;
+    /** Refresh the token if it is near expiry (or `force`) and persist it. */
+    syncSessionToken(options?: SyncOptions): Promise<string | null>;
+    /** Revoke the session server-side and clear the stored token. */
+    signOut(): Promise<void>;
+}
+/**
+ * Build an {@link AtlasClient}. `background: true` is accepted for parity with
+ * the sibling SDKs and to read as intent at the call site; the client behaves
+ * the same in a service worker as on a page.
+ */
+export declare function createAtlasClient(options: CreateAtlasClientOptions & {
+    background?: boolean;
+}): AtlasClient;
+export interface SyncOptions {
+    /** Refresh even if the current token is not yet inside its expiry window. */
+    force?: boolean;
+}
+/**
+ * Refresh and persist the session token — the call a background service worker
+ * makes (typically on a `chrome.alarms` tick, or before a token-gated request).
+ *
+ * A service worker has no long-lived timer of its own — MV3 evicts it — so the
+ * web SDK's in-page proactive-refresh loop does not translate. Instead the
+ * worker calls this whenever it wakes: it reads the stored token, and if it is
+ * within the refresh lead window (or `force`) mints a new one via
+ * `POST /v1/client/sessions/:sid/tokens` (bearer-authenticated by the client)
+ * and writes it back to `chrome.storage`.
+ *
+ * Returns the current token (fresh or unchanged), or null when signed out. A
+ * failed refresh returns the existing token rather than throwing — the worker
+ * can retry on its next tick, and the server rejects a truly-dead token on use.
+ */
+export declare function syncSessionToken(client: AtlasClient, options?: SyncOptions): Promise<string | null>;
+export type { ProviderToken };

package/dist/client.js

@@ -0,0 +1,168 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeTokenClaims = decodeTokenClaims;
+exports.bearerFetch = bearerFetch;
+exports.persistingBearerFetch = persistingBearerFetch;
+exports.createAtlasClient = createAtlasClient;
+exports.syncSessionToken = syncSessionToken;
+const js_1 = require("@atlasauth/js");
+const storage_1 = require("./storage");
+/** Read the unverified claims out of a JWT. Never a security decision — the
+ *  server validates the signature; this only tells the client which session to
+ *  refresh and roughly when. Returns null for anything that is not a JWT. */
+function decodeTokenClaims(jwt) {
+    const parts = jwt.split('.');
+    if (parts.length !== 3)
+        return null;
+    try {
+        return JSON.parse(atob(parts[1].replace(/-/g, '+').replace(/_/g, '/')));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Wrap a `fetch` so every request carries the current session token as a bearer.
+ * The token is read FRESH from the store on each call — never captured — so a
+ * refresh or a sign-out between requests is always reflected. A request made
+ * while signed out simply carries no `Authorization` header.
+ */
+function bearerFetch(fetchImpl, store) {
+    return async (input, init) => {
+        const token = await store.getToken();
+        const headers = new Headers(init?.headers);
+        if (token)
+            headers.set('authorization', `Bearer ${token}`);
+        return fetchImpl(input, { ...init, headers });
+    };
+}
+/** Pull a request URL string out of whatever `fetch` was handed. */
+function urlOf(input) {
+    if (typeof input === 'string')
+        return input;
+    if (input instanceof URL)
+        return input.toString();
+    return input.url;
+}
+/**
+ * A {@link bearerFetch} that ALSO captures a freshly-minted session token out of
+ * the response and persists it to the store.
+ *
+ * The web SDK's provider keeps its refreshed JWT in memory, which is exactly
+ * what an extension cannot do — the popup that received the token is closed
+ * moments later, and the service worker is torn down. So when a token-issuing
+ * endpoint (`/v1/client/...`) answers with a `jwt` in its JSON body, we write it
+ * back to `chrome.storage`, so the next request from ANY surface — and the next
+ * cold start of the service worker — picks up the current token. Scoped to
+ * `/v1/client` responses and guarded by JSON parsing, so a non-JSON or unrelated
+ * response is left untouched.
+ */
+function persistingBearerFetch(fetchImpl, store) {
+    return async (input, init) => {
+        const token = await store.getToken();
+        const headers = new Headers(init?.headers);
+        if (token)
+            headers.set('authorization', `Bearer ${token}`);
+        const response = await fetchImpl(input, { ...init, headers });
+        if (response.ok && /\/v1\/client(\/|\?|$)/.test(urlOf(input))) {
+            try {
+                const body = (await response.clone().json());
+                if (typeof body.jwt === 'string')
+                    await store.setToken(body.jwt);
+            }
+            catch {
+                // Not JSON, or no body (a 204 revoke). Nothing to capture.
+            }
+        }
+        return response;
+    };
+}
+/**
+ * Build an {@link AtlasClient}. `background: true` is accepted for parity with
+ * the sibling SDKs and to read as intent at the call site; the client behaves
+ * the same in a service worker as on a page.
+ */
+function createAtlasClient(options) {
+    const store = options.store ?? new storage_1.StorageCache();
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const fapi = new js_1.FapiClient({
+        publishableKey: options.publishableKey,
+        baseUrl: options.frontendApi,
+        fetchImpl: bearerFetch(fetchImpl, store),
+    });
+    const client = {
+        fapi,
+        store,
+        getToken: () => store.getToken(),
+        setToken: (token) => store.setToken(token),
+        getProviderToken: (provider) => getProviderTokenFor(fapi, provider),
+        syncSessionToken: (opts) => syncSessionToken(client, opts),
+        signOut: async () => {
+            const current = await store.getToken();
+            const sid = current ? decodeTokenClaims(current)?.sid : undefined;
+            if (sid) {
+                // Best-effort server revoke; the local token is cleared regardless so
+                // the extension never keeps showing a signed-in state after sign-out.
+                await fapi.post(`/v1/client/sessions/${sid}/revoke`).catch(() => undefined);
+            }
+            await store.removeToken();
+        },
+    };
+    return client;
+}
+/**
+ * Refresh and persist the session token — the call a background service worker
+ * makes (typically on a `chrome.alarms` tick, or before a token-gated request).
+ *
+ * A service worker has no long-lived timer of its own — MV3 evicts it — so the
+ * web SDK's in-page proactive-refresh loop does not translate. Instead the
+ * worker calls this whenever it wakes: it reads the stored token, and if it is
+ * within the refresh lead window (or `force`) mints a new one via
+ * `POST /v1/client/sessions/:sid/tokens` (bearer-authenticated by the client)
+ * and writes it back to `chrome.storage`.
+ *
+ * Returns the current token (fresh or unchanged), or null when signed out. A
+ * failed refresh returns the existing token rather than throwing — the worker
+ * can retry on its next tick, and the server rejects a truly-dead token on use.
+ */
+async function syncSessionToken(client, options = {}) {
+    const current = await client.store.getToken();
+    if (!current)
+        return null;
+    const claims = decodeTokenClaims(current);
+    const expiresAt = (0, js_1.readExpiry)(current);
+    // Still comfortably fresh and no force → nothing to do, and no needless call.
+    if (!options.force && expiresAt !== null) {
+        const wait = (0, js_1.msUntilRefresh)({
+            token: { jwt: current, expiresAt, sessionId: claims?.sid ?? '' },
+            now: Date.now(),
+        });
+        if (wait > 0)
+            return current;
+    }
+    const sid = claims?.sid;
+    if (!sid)
+        return current;
+    const response = await client.fapi.post(`/v1/client/sessions/${sid}/tokens`);
+    if (!response.ok || !response.data?.jwt)
+        return current;
+    await client.store.setToken(response.data.jwt);
+    return response.data.jwt;
+}
+/**
+ * §6.6 token vault. The signed-in user's OWN live access token at a connected
+ * provider, so the extension can call e.g. the Google API directly. Returns null
+ * when there is no usable token (no linked account / provider granted none).
+ */
+async function getProviderTokenFor(fapi, provider) {
+    const response = await fapi.get(`/v1/client/me/external_accounts/${encodeURIComponent(provider)}/token`);
+    if (!response.ok || !response.data)
+        return null;
+    return {
+        provider: response.data.provider,
+        accessToken: response.data.access_token,
+        expiresAt: response.data.expires_at ?? null,
+        scopes: response.data.scopes ?? [],
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;AAwBA,8CAUC;AAQD,kCAOC;AAsBD,sDAoBC;AAuCD,8CA8BC;AAsBD,4CA6BC;AAnND,sCAA2F;AAC3F,uCAA0D;AAoB1D;;6EAE6E;AAC7E,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CACf,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAChC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,SAAuB,EAAE,KAAiB;IACpE,OAAO,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;QAC5D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAC3D,OAAO,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAS,KAAK,CAAC,KAAwB;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,YAAY,GAAG;QAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IAClD,OAAQ,KAAiB,CAAC,GAAG,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,qBAAqB,CACnC,SAAuB,EACvB,KAAiB;IAEjB,OAAO,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAE,EAAE;QAC5D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAE9D,IAAI,QAAQ,CAAC,EAAE,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAsB,CAAC;gBAClE,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnE,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;YAC7D,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAkCD;;;;GAIG;AACH,SAAgB,iBAAiB,CAC/B,OAA4D;IAE5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,sBAAY,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,eAAU,CAAC;QAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO,EAAE,OAAO,CAAC,WAAW;QAC5B,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC;KACzC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAgB;QAC1B,IAAI;QACJ,KAAK;QACL,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE;QAChC,QAAQ,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClD,gBAAgB,EAAE,CAAC,QAAgB,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC3E,gBAAgB,EAAE,CAAC,IAAkB,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC;QACxE,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,IAAI,GAAG,EAAE,CAAC;gBACR,sEAAsE;gBACtE,sEAAsE;gBACtE,MAAM,IAAI,CAAC,IAAI,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;QAC5B,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD;;;;;;;;;;;;;;GAcG;AACI,KAAK,UAAU,gBAAgB,CACpC,MAAmB,EACnB,UAAuB,EAAE;IAEzB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC9C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAA,eAAU,EAAC,OAAO,CAAC,CAAC;IAEtC,8EAA8E;IAC9E,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,IAAA,mBAAc,EAAC;YAC1B,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,EAAE;YAChE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;SAChB,CAAC,CAAC;QACH,IAAI,IAAI,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC;IAC/B,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,CAAC;IACxB,IAAI,CAAC,GAAG;QAAE,OAAO,OAAO,CAAC;IAEzB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CACrC,uBAAuB,GAAG,SAAS,CACpC,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG;QAAE,OAAO,OAAO,CAAC;IAExD,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAChC,IAAgB,EAChB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAK5B,mCAAmC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE5E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ;QAChC,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY;QACvC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI;QAC3C,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE;KACnC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `@atlasauth/chrome-extension` — the React-free core.
+ *
+ * This entry point (the package root) pulls in NO React and NO DOM renderer, so
+ * it is safe to import from a background service worker or a content script. It
+ * gives you the token store and the FAPI client + session-token lifecycle:
+ *
+ *   import { createAtlasClient, StorageCache } from '@atlasauth/chrome-extension';
+ *
+ * For the React provider + hooks, import from `@atlasauth/chrome-extension/react`
+ * (React is an optional peer). For the background helpers under an explicit,
+ * intent-revealing name, `@atlasauth/chrome-extension/background` re-exports them.
+ */
+export * from './storage';
+export * from './client';

package/dist/index.js

@@ -0,0 +1,32 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * `@atlasauth/chrome-extension` — the React-free core.
+ *
+ * This entry point (the package root) pulls in NO React and NO DOM renderer, so
+ * it is safe to import from a background service worker or a content script. It
+ * gives you the token store and the FAPI client + session-token lifecycle:
+ *
+ *   import { createAtlasClient, StorageCache } from '@atlasauth/chrome-extension';
+ *
+ * For the React provider + hooks, import from `@atlasauth/chrome-extension/react`
+ * (React is an optional peer). For the background helpers under an explicit,
+ * intent-revealing name, `@atlasauth/chrome-extension/background` re-exports them.
+ */
+__exportStar(require("./storage"), exports);
+__exportStar(require("./client"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;GAYG;AACH,4CAA0B;AAC1B,2CAAyB"}

package/dist/react.d.ts

@@ -0,0 +1,33 @@
+import { type AtlasProviderProps } from '@atlasauth/react';
+import { type TokenStore } from './storage';
+/**
+ * `<AtlasProvider>` for a Chrome/MV3 extension.
+ *
+ * A thin wrapper over `@atlasauth/react`'s provider. It reuses the entire React
+ * SDK — the same hooks (`useAuth`, `useUser`, …), the same components — and
+ * changes exactly ONE thing: how the session travels. The web provider assumes
+ * cookies (`credentials: 'include'`); an extension has none, so this wrapper
+ * injects a `fetchImpl` that instead
+ *   1. attaches the token from the extension's {@link TokenStore} as a bearer, and
+ *   2. captures any freshly-minted token out of a `/v1/client` response back
+ *      into `chrome.storage`, so it survives the popup closing and the service
+ *      worker being torn down.
+ *
+ * React and `@atlasauth/react` are OPTIONAL peer dependencies — this module is
+ * only reached through the `@atlasauth/chrome-extension/react` entry point. A
+ * background service worker imports the React-free core (`createAtlasClient`,
+ * `syncSessionToken`, `StorageCache`) from the package root instead and never
+ * pulls React in.
+ *
+ * The token must already be in the store (seed it with `client.setToken(jwt)`
+ * after a hosted sign-in, or let a prior session persist it). This provider does
+ * not itself drive the sign-in UI flow.
+ */
+export interface ChromeAtlasProviderProps extends Omit<AtlasProviderProps, 'fetchImpl'> {
+    /** Where the token lives. Defaults to `chrome.storage.local` via {@link StorageCache}. */
+    store?: TokenStore;
+    /** Base `fetch` to wrap (before bearer/persist). Defaults to the platform `fetch`. */
+    fetchImpl?: typeof fetch;
+}
+export declare function AtlasProvider(props: ChromeAtlasProviderProps): import("react").FunctionComponentElement<AtlasProviderProps>;
+export * from '@atlasauth/react';

package/dist/react.js

@@ -0,0 +1,30 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AtlasProvider = AtlasProvider;
+const react_1 = require("react");
+const react_2 = require("@atlasauth/react");
+const client_1 = require("./client");
+const storage_1 = require("./storage");
+function AtlasProvider(props) {
+    const { store, fetchImpl, ...rest } = props;
+    const wrappedFetch = (0, react_1.useMemo)(() => (0, client_1.persistingBearerFetch)(fetchImpl ?? fetch, store ?? new storage_1.StorageCache()), [store, fetchImpl]);
+    return (0, react_1.createElement)(react_2.AtlasProvider, { ...rest, fetchImpl: wrappedFetch });
+}
+// Re-export the React SDK surface so extension code has one import site for the
+// provider AND the hooks/components it renders inside it.
+__exportStar(require("@atlasauth/react"), exports);
+//# sourceMappingURL=react.js.map

package/dist/react.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"react.js","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAmCA,sCASC;AA5CD,iCAA+C;AAC/C,4CAAgG;AAChG,qCAAiD;AACjD,uCAA0D;AAgC1D,SAAgB,aAAa,CAAC,KAA+B;IAC3D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAE5C,MAAM,YAAY,GAAG,IAAA,eAAO,EAC1B,GAAG,EAAE,CAAC,IAAA,8BAAqB,EAAC,SAAS,IAAI,KAAK,EAAE,KAAK,IAAI,IAAI,sBAAY,EAAE,CAAC,EAC5E,CAAC,KAAK,EAAE,SAAS,CAAC,CACnB,CAAC;IAEF,OAAO,IAAA,qBAAa,EAAC,qBAAkB,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,gFAAgF;AAChF,0DAA0D;AAC1D,mDAAiC"}

package/dist/storage.d.ts

@@ -0,0 +1,79 @@
+/**
+ * The extension token store.
+ *
+ * A browser extension surface — popup, options page, side panel, a content
+ * script, and the background service worker — has NO cookie jar to the Atlas
+ * FAPI origin. A cross-origin `fetch` from an extension cannot lean on the
+ * browser attaching a session cookie the way a first-party web app does, so the
+ * whole cookie-based session the web SDK relies on is simply unavailable. The
+ * session token therefore has to live somewhere the extension itself controls,
+ * and be attached to every request by hand as a bearer.
+ *
+ * `chrome.storage.local` is that place:
+ *   - it SURVIVES the service worker being torn down between events (a plain
+ *     module-level variable in a service worker does not — MV3 kills the worker
+ *     when idle and re-imports it on the next event, losing memory state);
+ *   - it is readable from EVERY extension surface, so the popup that signs the
+ *     user in and the background worker that refreshes the token share one copy.
+ *
+ * This module is the single owner of "where the token lives". Everything else
+ * (the FAPI client, the background sync, the React provider) reads and writes it
+ * only through the {@link TokenStore} interface below.
+ */
+/**
+ * The minimal, structural shape of the two `chrome.storage.local` methods this
+ * package uses. Declared here — rather than pulled from `@types/chrome` — so the
+ * package type-checks with NO extra type dependency; at runtime the extension
+ * platform supplies the real object. MV3's `chrome.storage` methods return a
+ * Promise when called without a callback, which is the form used throughout.
+ */
+export interface ChromeStorageArea {
+    get(keys: string | string[] | null): Promise<Record<string, unknown>>;
+    set(items: Record<string, unknown>): Promise<void>;
+    remove(keys: string | string[]): Promise<void>;
+}
+/**
+ * The three-method contract the rest of the SDK depends on. `StorageCache` is
+ * the shipped `chrome.storage.local` implementation; tests and non-extension
+ * prototypes can supply any object with this shape.
+ */
+export interface TokenStore {
+    /** The stored session token, or null when signed out. */
+    getToken(): Promise<string | null>;
+    /** Persist the session token. Called after sign-in and on every refresh. */
+    setToken(token: string): Promise<void>;
+    /** Drop the token. Called on sign-out and when a session is rejected. */
+    removeToken(): Promise<void>;
+}
+/** The storage key the token is kept under. Namespaced to avoid collisions. */
+export declare const DEFAULT_TOKEN_KEY = "__atlas_session_token";
+export interface StorageCacheOptions {
+    /** Override the storage key (e.g. to isolate multiple instances). */
+    key?: string;
+    /**
+     * The backing storage area. Defaults to `chrome.storage.local`, resolved
+     * lazily on first use. Inject an in-memory area ({@link createMemoryStorageArea})
+     * in tests, or `chrome.storage.session` / `.sync` to change persistence.
+     */
+    area?: ChromeStorageArea;
+}
+/**
+ * A token cache over `chrome.storage.local`. The session token is a single
+ * string value under one key — the extension analogue of the web SDK's cookie.
+ */
+export declare class StorageCache implements TokenStore {
+    private readonly key;
+    private area;
+    constructor(options?: StorageCacheOptions);
+    private storage;
+    getToken(): Promise<string | null>;
+    setToken(token: string): Promise<void>;
+    removeToken(): Promise<void>;
+}
+/**
+ * An in-memory `ChromeStorageArea`, for tests and for prototyping outside an
+ * extension. It implements the same async contract as the real thing but keeps
+ * everything in a `Map`, so it does NOT survive a process (or service-worker)
+ * restart — never ship it as the store in production.
+ */
+export declare function createMemoryStorageArea(): ChromeStorageArea;

package/dist/storage.js

@@ -0,0 +1,107 @@
+"use strict";
+/**
+ * The extension token store.
+ *
+ * A browser extension surface — popup, options page, side panel, a content
+ * script, and the background service worker — has NO cookie jar to the Atlas
+ * FAPI origin. A cross-origin `fetch` from an extension cannot lean on the
+ * browser attaching a session cookie the way a first-party web app does, so the
+ * whole cookie-based session the web SDK relies on is simply unavailable. The
+ * session token therefore has to live somewhere the extension itself controls,
+ * and be attached to every request by hand as a bearer.
+ *
+ * `chrome.storage.local` is that place:
+ *   - it SURVIVES the service worker being torn down between events (a plain
+ *     module-level variable in a service worker does not — MV3 kills the worker
+ *     when idle and re-imports it on the next event, losing memory state);
+ *   - it is readable from EVERY extension surface, so the popup that signs the
+ *     user in and the background worker that refreshes the token share one copy.
+ *
+ * This module is the single owner of "where the token lives". Everything else
+ * (the FAPI client, the background sync, the React provider) reads and writes it
+ * only through the {@link TokenStore} interface below.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StorageCache = exports.DEFAULT_TOKEN_KEY = void 0;
+exports.createMemoryStorageArea = createMemoryStorageArea;
+/** The storage key the token is kept under. Namespaced to avoid collisions. */
+exports.DEFAULT_TOKEN_KEY = '__atlas_session_token';
+/**
+ * Resolve `chrome.storage.local` off the global. Done lazily (on first access,
+ * not at construction) so importing or wiring the SDK never throws in a context
+ * where `chrome` is absent — only an actual read/write does.
+ */
+function resolveChromeLocal() {
+    const runtime = globalThis.chrome;
+    const local = runtime?.storage?.local;
+    if (!local) {
+        throw new Error('@atlasauth/chrome-extension: chrome.storage.local is unavailable. Run this ' +
+            'inside an extension with the "storage" permission in its manifest, or pass ' +
+            'a custom `area` to StorageCache (e.g. createMemoryStorageArea()).');
+    }
+    return local;
+}
+/**
+ * A token cache over `chrome.storage.local`. The session token is a single
+ * string value under one key — the extension analogue of the web SDK's cookie.
+ */
+class StorageCache {
+    key;
+    area;
+    constructor(options = {}) {
+        this.key = options.key ?? exports.DEFAULT_TOKEN_KEY;
+        // Held null until first use so construction never touches `chrome`.
+        this.area = options.area ?? null;
+    }
+    storage() {
+        if (!this.area)
+            this.area = resolveChromeLocal();
+        return this.area;
+    }
+    async getToken() {
+        const result = await this.storage().get(this.key);
+        const value = result[this.key];
+        return typeof value === 'string' ? value : null;
+    }
+    async setToken(token) {
+        await this.storage().set({ [this.key]: token });
+    }
+    async removeToken() {
+        await this.storage().remove(this.key);
+    }
+}
+exports.StorageCache = StorageCache;
+/**
+ * An in-memory `ChromeStorageArea`, for tests and for prototyping outside an
+ * extension. It implements the same async contract as the real thing but keeps
+ * everything in a `Map`, so it does NOT survive a process (or service-worker)
+ * restart — never ship it as the store in production.
+ */
+function createMemoryStorageArea() {
+    const map = new Map();
+    const pick = (keys) => {
+        if (keys === null)
+            return Object.fromEntries(map);
+        const list = Array.isArray(keys) ? keys : [keys];
+        const out = {};
+        for (const k of list) {
+            if (map.has(k))
+                out[k] = map.get(k);
+        }
+        return out;
+    };
+    return {
+        get: (keys) => Promise.resolve(pick(keys)),
+        set: (items) => {
+            for (const [k, v] of Object.entries(items))
+                map.set(k, v);
+            return Promise.resolve();
+        },
+        remove: (keys) => {
+            for (const k of Array.isArray(keys) ? keys : [keys])
+                map.delete(k);
+            return Promise.resolve();
+        },
+    };
+}
+//# sourceMappingURL=storage.js.map

package/dist/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;AAuGH,0DAwBC;AAlGD,+EAA+E;AAClE,QAAA,iBAAiB,GAAG,uBAAuB,CAAC;AAazD;;;;GAIG;AACH,SAAS,kBAAkB;IACzB,MAAM,OAAO,GACX,UACD,CAAC,MAAM,CAAC;IACT,MAAM,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,6EAA6E;YAC3E,6EAA6E;YAC7E,mEAAmE,CACtE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAa,YAAY;IACN,GAAG,CAAS;IACrB,IAAI,CAA2B;IAEvC,YAAY,UAA+B,EAAE;QAC3C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,yBAAiB,CAAC;QAC5C,oEAAoE;QACpE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;IACnC,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,kBAAkB,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa;QAC1B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;CACF;AA5BD,oCA4BC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEvC,MAAM,IAAI,GAAG,CAAC,IAA8B,EAA2B,EAAE;QACvE,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,OAAO;QACL,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;YACb,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1D,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACf,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACnE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@atlasauth/chrome-extension",
+  "version": "0.1.0",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./background": {
+      "types": "./dist/background.d.ts",
+      "default": "./dist/background.js"
+    },
+    "./react": {
+      "types": "./dist/react.d.ts",
+      "default": "./dist/react.js"
+    }
+  },
+  "dependencies": {
+    "@atlasauth/js": "0.1.4",
+    "@atlasauth/react": "0.1.13"
+  },
+  "peerDependencies": {
+    "react": ">=18"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/react": "^18.3.12",
+    "react": "^18.3.1",
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
+}